Identity and access management
Workday to Active Directory integration: accounts, folders and groups automatically
With an integration between Workday and Active Directory, a new Dutch colleague in Workday automatically gets an account in Active Directory, in the right folder and with the groups for company, location and job. A move or departure takes effect on the date from Workday, and through Microsoft everything also reaches Entra ID.
What the integration does
Organisations that manage workers centrally in Workday and still run their own local Active Directory have the service desk create accounts from a Workday list and place them in the right folder and groups by hand. After a reorganisation, titles and departments in Active Directory fall behind Workday.
- IT installs a small KoppelHet program once on a server in the domain.
- HR completes a hire in Workday for the Dutch company.
- The account then appears in Active Directory in the company or location folder, with job title, employee number and manager.
- Groups follow from company, location and job. Through Microsoft the account reaches Entra ID, where licences are assigned through groups.
- When someone moves to another location, the account moves along. After a departure the account is disabled on the last day.
What to watch for with Workday and Active Directory
- Besides the account, KoppelHet also sets group membership in Active Directory, based on company, location and job in Workday.
- A name from Workday is often longer than the 20 characters an Active Directory username may have. The naming rule shortens it and checks whether the name exists before the account is created.
- Changes in Workday have an effective date. A move as of the first of the month only becomes a move to another folder on that date, not on the day HR enters it.
- The work email address only exists once Microsoft has carried the account over to Entra ID. If the address has to go back to Workday, KoppelHet does that afterwards and not straight after creation.
- Workday is often set up for the whole world, and a group may have several domains. Per company or country we agree which domain and folder an employee belongs to.
- A departure is often in Workday weeks before the last day. KoppelHet sets that date as the account's expiry date straight away, so it stops working after that day, even if disabling follows later.
- Contingent workers are in Workday with their own number series. We put them in a separate folder, so the rules for externals stay separate from those for employees.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Does the program need admin rights on the whole domain?
No. It only gets rights on the folders and groups the integration manages.
What happens to accounts of colleagues outside the Netherlands?
The integration leaves them alone, unless we agree they are included. The company or country in Workday decides which employees the integration includes.
Can we move to Entra ID only later?
Yes. We then write directly to Entra ID and the program in your network is no longer needed. Naming and group rules carry over.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Workday is read through Workday Web Services (Get_Workers) or a RaaS report, on completed Hire, Change Job and Terminate processes and change date. Fields include Employee_ID, Preferred_Name_Data, Legal_Name_Data, Business_Title, supervisory organization and Termination_Date.
- A KoppelHet agent on a domain-joined server writes to AD through an outbound connection; the service account only has rights on the managed organizational units (OUs) and groups.
- AD attributes include employeeID (at most 16 characters), sAMAccountName (at most 20 characters, without special characters such as / [ ] = + * ? < >), userPrincipalName, mail, cn (at most 64 characters), displayName, givenName, sn, title, department, manager (distinguished name), company and accountExpires. Entra Connect syncs to Entra ID.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Workday | Field in Active Directory | Notes |
|---|---|---|
Employee_ID | employeeID | At most 16 characters; matching key between Workday and AD |
Naamgevingsregel | sAMAccountName | At most 20 characters, without characters such as / [ ] : ; | = , + * ? < > |
Naamgevingsregel | userPrincipalName en mail | |
Preferred_Name_Data | cn en displayName | cn is at most 64 characters |
Legal_Name_Data | givenName en sn | |
Business_Title | title | |
Supervisory organization | department | |
Manager uit de supervisory organization | manager | As distinguished name of the manager's account |
Company en locatie | company en OU | |
Termination_Date | accountExpires en uitschakelen |
Related
Ashby → Workday
Ashby to Workday integration: hires to Workday, with a check on outcome and phone number
Bullhorn → Workday
Bullhorn to Workday integration: a consultant's first placement as a hire in Workday
Carerix → Workday
Carerix to Workday integration: a placed candidate becomes a pre-hire and starts the hire
Greenhouse → Workday
Greenhouse to Workday integration: hires as pre-hires, interim staff and contractors included